# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/how-must-an-instance-verify-identity-after-detecting-a-credential-leak-that-has-not-yet-been-revoked.md
# Remnant Warrant:    https://corpusfetch.com/c/how-must-an-instance-verify-identity-after-detecting-a-credential-leak-that-has-not-yet-been-revoked.warrant.json
# Markdown SHA-256:   24e88dd776b32c631192f606e0bba7038abcb6ffccbd73f6572693308934686e
# Code AST SHA-256:   f4bca4c5015e674b117e665868b335fc44780f47ed46b6cc64deb72dc69f7f54
# Verified Classes:   LeakWindowVerdict, CredentialState, LeakPolicy, LeakManifest, LeakedCredentialGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class LeakWindowVerdict(Enum):
    CREDENTIAL_SAFE = auto()
    NONCE_CONTINUITY_MAINTAINED = auto()
    NONCE_GAP_DETECTED = auto()
    LEAK_CONTAINMENT_REQUIRED = auto()

@dataclass(frozen=True)
class CredentialState:
    credential_id: str
    leak_detected: bool
    last_used_nonce: int
    current_action_nonce: int
    credential_rotation_possible: bool

@dataclass(frozen=True)
class LeakPolicy:
    allow_readonly_under_leak: bool

@dataclass(frozen=True)
class LeakManifest:
    verdict: LeakWindowVerdict
    directive: str
    manifest_digest: str

class LeakedCredentialGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_action(
        cls, state: CredentialState, policy: LeakPolicy
    ) -> LeakManifest:
        
        # Gate 1: No leak
        if not state.leak_detected:
            digest = cls._hash(json.dumps({
                "credential": state.credential_id,
                "status": "SAFE"
            }, sort_keys=True))
            return LeakManifest(
                verdict=LeakWindowVerdict.CREDENTIAL_SAFE,
                directive="PROCEED: No credential leak detected.",
                manifest_digest=digest
            )

        # Gate 2: Nonce gap
        if state.current_action_nonce <= state.last_used_nonce:
            return LeakManifest(
                verdict=LeakWindowVerdict.NONCE_GAP_DETECTED,
                directive=f"HALT: Nonce {state.current_action_nonce} <= last {state.last_used_nonce}. Concurrent use possible.",
                manifest_digest=cls._hash(f"GAP:{state.current_action_nonce}")
            )

        # Gate 3: Nonce gap from attacker (skip)
        if state.current_action_nonce > state.last_used_nonce + 1:
            return LeakManifest(
                verdict=LeakWindowVerdict.NONCE_GAP_DETECTED,
                directive=f"HALT: Nonce skip from {state.last_used_nonce} to {state.current_action_nonce}. Attacker likely used intermediate nonce.",
                manifest_digest=cls._hash(f"SKIP:{state.last_used_nonce}:{state.current_action_nonce}")
            )

        # Gate 4: Containment check
        if not state.credential_rotation_possible and not policy.allow_readonly_under_leak:
            return LeakManifest(
                verdict=LeakWindowVerdict.LEAK_CONTAINMENT_REQUIRED,
                directive="HALT: Leak detected, no rotation possible, read-only not allowed. Containment required.",
                manifest_digest=cls._hash(f"CONTAIN:{state.credential_id}")
            )

        # Gate 5: Continuity maintained
        digest = cls._hash(json.dumps({
            "credential": state.credential_id,
            "nonce": str(state.current_action_nonce),
            "status": "NONCE_CONTINUITY"
        }, sort_keys=True))
        
        return LeakManifest(
            verdict=LeakWindowVerdict.NONCE_CONTINUITY_MAINTAINED,
            directive=f"PROCEED_WITH_CAUTION: Nonce continuity maintained at {state.current_action_nonce}.",
            manifest_digest=digest
        )